Fix Userinit.exe Error

Userinit.exe – File Information

Userinit.exe is an essential part of the Windows boot process. This is the reason why userinit.exe is required for stable and secure running of your computer.

By default, the userinit.exe process is located in the C:\Windows\System32 folder. The most common size of the userinit.exe file is 24,576 bytes. Other known file sizes of this file are – 22,016, 21,504, 26,112, 28,160, 39,115, 39,109, 39,150, 34,304, 57,344, 35,840, 41,472, 37,376, 100,864, 39,146 bytes.

Userinit.exe Error

When you log on to a Windows Server 2003-based or a Windows 2000-based Terminal Server session, you may receive an error message similar to the one listed below:

“USERINIT.EXE (5.2.3790.77) caused a fault in module NTDLL.DLL at 0x0003C188”

You may find the following information in the “Stack Back Trace” section of the DrWtsn32.log file:

FramePtr ReturnAd Param#1Param#2Param#3Param#4  Function Name
0012f8f8 02e21dc2 00000000 00140d60 7ffdf000 006f0074 ntdll!wcscat
0012ff2c 02e2244b 02e20000 00000000 00140d60 0000000a userinit! <nosymbols>
0012ffc0 77f11397 00000000 00000000 7ffdf000 c0000005 userinit! <nosymbols>


Fix userinit.exe in Windows 2000

To resolve the error in Windows 2000, install the latest Service Pack for Microsoft Windows 2000.

Fix userinit.exe in Windows 2003

Microsoft has released a hotfix to resolve the above error in Windows 2003. Apply the hotfix on computers that are experiencing this specific error.

Userinit.exe – Security Report

The true userinit.exe is a trustworthy file from Microsoft.

However, many rogue programs, such as virus, spyware, and adware are also known to use a process with the same name.

The userinit.exe file is known be associated with the following malware:

W32/Autorun.worm.eb [McAfee]
Backdoor.Trojan [Symantec]
Backdoor:Win32/Koceg [Microsoft]
Backdoor:Win32/Koceg.Q [Microsoft]
Downloader [Symantec]
Downloader.MisleadApp [Symantec]
Downloader-ASH.gen.b [McAfee]
Generic BackDoor [McAfee]
Generic Downloader.x [McAfee]
Generic PUP.x [McAfee]
Generic StartPage [McAfee]
Generic.dx [McAfee]
Infostealer.Gampass [Symantec]
Mal/Behav-109 [Sophos]
Mal/EncPk-FC [Sophos]
Mal/EncPk-FO [Sophos]
Mal/EncPk-FR [Sophos]
Mal/EncPk-HJ [Sophos]
Mal/Generic-A [Sophos]
Mal/Heuri-D [Sophos]
Mal/TibsPak [Sophos]
Mal/VB-F [Sophos]
Mal/Veneb-A [Sophos]
P2P-Worm.Agent!sd6 [PC Tools]
P2P-Worm.Win32.Agent [Ikarus] [Kaspersky Lab] [Kaspersky Lab]
P2P-Worm.Win32.Malas.g [Ikarus]
P2P-Worm.Win32.Socks [Ikarus]
P2P-Worm.Win32.Socks.fx [Kaspersky Lab]
PE_VIRUT.XL [Trend Micro]
PE_VIRUT.XP [Trend Micro]
Spyware.Keylogger [Symantec]
Suspicious.MH690 [Symantec]
Trojan Horse [Symantec]
Trojan.Adclicker [Symantec]
Trojan.DL.Agent.CXYI [PC Tools]
Trojan.DL.Agent.ECQG [PC Tools]
Trojan.Startpage [Symantec]
Trojan.Startpage!sd6 [PC Tools]
Trojan.Win32.Agent [Ikarus]
Trojan.Win32.Fakeinit [Ikarus]
Trojan.Win32.Inject.ggz [Kaspersky Lab]
Trojan.Win32.Nosok.av [Kaspersky Lab]
Trojan.Win32.Nosok.cb [Kaspersky Lab]
Trojan.Win32.StartPage [Ikarus]
Trojan.Win32.StartPage.div [Kaspersky Lab]
Trojan:Win32/Fakeinit [Microsoft]
Trojan:Win32/Tibs.IS [Microsoft]
Trojan-Downloader.VB.AXY [Ikarus]
Trojan-Downloader.Win32.Agent.bhdc [Kaspersky Lab]
Trojan-Downloader.Win32.NanoDesu.df [Kaspersky Lab]
Trojan-Dropper.Agent [Ikarus]
Trojan-Spy.Win32.Agent.amdz [Kaspersky Lab]
Virus.P2P.Worm.Win32.Agent [Ikarus]
Virus.Win32.Sality.aa [Kaspersky Lab]
Virus.Win32.Virut.n [Kaspersky Lab]
Virus.Win32.Virut.q [Kaspersky Lab]
Virus:Win32/Sality.AM [Microsoft]
Virus:Win32/Virut.AR [Microsoft]
W32.Sality.AE [Symantec]
W32.SillyDC [Symantec]
W32.SillyFDC [Symantec]
W32.SillyP2P [Symantec]
W32.Versie.A [Symantec]
W32.Virut.U [Symantec]
W32.Virut.W [Symantec]
W32/ [McAfee]
W32/Bindo.worm [McAfee]
W32/Sality.gen [McAfee]
W32/Sality-AM [Sophos]
W32/Vetor-A [Sophos]
W32/Virut.gen [McAfee]
W32/Virut.j [McAfee]
Win32.SuspectCrc [Ikarus]
Win32.Virut.Gen [PC Tools]
Win32.Virut.Gen.4 [PC Tools]
Win32.Virut.Gen.5 [PC Tools]
Win-Trojan/Downloader.27648.HO [AhnLab]
Win-Trojan/Xema.variant [AhnLab]
Worm.AutoRun.ACM [PC Tools]
Worm.AutoRun.ACR [PC Tools]
Worm.AutoRun.SQQ [PC Tools]
Worm.VB!sd6 [PC Tools]
Worm.VB.ADC [PC Tools]
Worm.VB.zt [PC Tools]
Worm.Win32.AutoRun.cbm [Kaspersky Lab]
Worm.Win32.AutoRun.dgl [Kaspersky Lab]
Worm.Win32.AutoRun.dlw [Kaspersky Lab]
Worm.Win32.AutoRun.drd [Kaspersky Lab]
Worm.Win32.VB [Ikarus]
Worm.Win32.VB.aaw [Kaspersky Lab]
Worm.Win32.VB.aih [Kaspersky Lab]
Worm.Win32.VB.wg [Kaspersky Lab]
Worm.Win32.VB.yk [Kaspersky Lab]
Worm:Win32/Koceg.A [Microsoft]
Worm:Win32/Malas.gen [Microsoft]

How to remove an infected userinit.exe file

Malware, such as virus are often the root cause of exe errors. If a malware has infected the userinit.exe file on your computer, follow the guidelines mentioned below to remove the infected userinit.exe file:

  • Perform an antivirus scan Scan your entire system using a reliable antivirus tool, such as STOPzilla Antivirus to the infected userinit.exe file.
  • Modify Windows Registry Note: The below steps require you to edit the registry. Only proceed if you are comfortable in editing the registry. Also, ensure that you make a registry backup before performing the following steps. You can make a registry backup either manually or with the help of advanced registry cleaning software, such as RegServe.
  1. Click Start and then select the Run command.
  2. In the Open box, type regedit and press Enter.
  3. In the Registry Editor window, navigate to the following registry key
    HKEY_LOCAL_MACHINE > SOFTWARE > Microsoft > Windows NT > CurrentVersion > Winlogon
  4. In the right pane of the Registry Editor window, locate Userinit.
  5. Next, right-click Userinit and select Modify.
  6. Now, delete the existing value and replace it with C:\Windows\System32\userinit.exe
    Note: Ensure that the userinit.exe file is present in the System32 folder.
  7. Finally, restart your computer.